Um, it doesn't have too...

Why not start with re-reading existing consumer data protection law? I bet there's stuff in there that can be applied and reworked.

We need it to be appropriately scary for companies to abuse data.